CVE-2025-68705: RustFS Path Traversal Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-01-07 · updated 2026-10-14
Weakness: CWE-22

Description

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.78, RustFS contains a path traversal vulnerability in the /rustfs/rpc/read_file_stream endpoint. This issue has been patched in version 1.0.0-alpha.79.

Affected products

rustfs: 1.0.0-alpha13, 1.0.0-alpha14, 1.0.0-alpha15, 1.0.0-alpha16, 1.0.0-alpha17, 1.0.0-alpha18 (+60)

References

https://github.com/rustfs/rustfs/commit/ab752458ce431c6397175d167beee2ea00507d3e
https://github.com/rustfs/rustfs/security/advisories/GHSA-pq29-69jg-9mxc

Get alerted when CVE-2025-68705 or the next vulnerability affects your stack